Oracle Transportation Management CVE-2026-60584

Exploitation requires the attacker to hold a valid low-privileged Oracle Transportation Management account (CVSS PR:L) with network access to the OTM web interface over HTTP, and specifically requires the ability to reach the CSV Management component's functionality. What limits exploitation: it is not pre-authentication - a credentialed application user is needed - and it is confined to OTM version 6.5.3 deployments where CSV Management is accessible to the attacker's role; there is no user-interaction requirement and complexity is low, so any authenticated low-privilege user who can reach CSV features is a realistic threat. The 'Authentication Bypass' tag suggests the flaw may let such a user bypass authorization controls, but the exact triggering configuration is not detailed in the source data and should be confirmed with Oracle's advisory.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L, base 7.6) indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with high confidentiality impact but only low integrity and availability impact - meaning the primary real-world risk is bulk data disclosure rather than full system compromise. No EPSS score, KEV listing, or POC was provided, so exploitation probability cannot be quantified from the input; there is no evidence of active exploitation. This is a genuine priority for organizations running OTM 6.5.3 because low-privileged application users are common and the attack is easily exploitable per Oracle, but it is not a drop-everything internet-wide emergency: exploitation requires valid (if low-level) credentials, and the integrity/availability damage is bounded. Note a minor tension in the intelligence - the 'Authentication Bypass' tag suggests circumventing auth, yet the CVSS vector encodes PR:L (attacker already holds low privileges); this likely means privilege/authorization bypass by an authenticated user rather than pre-auth bypass, but it should be verified against Oracle's advisory.

An attacker who has obtained or been granted a low-privilege OTM application account authenticates over HTTP and interacts with the CSV Management component to request or manipulate data outside their authorization scope, exfiltrating sensitive transportation, shipment, and partner data across the application. Given low attack complexity and no required user interaction, the actor could also perform limited unauthorized inserts/updates/deletes and trigger a partial denial of service. No public proof-of-concept was identified at time of analysis.